EU High Court Rules Online Marketplaces Must Vet Data Posted by Users Prior to Publication

“EU law obliges the operator of an online marketplace to take responsibility for personal data contained in advertisements published on its platform, in compliance with the GDPR,” the Court of Justice of the European Union said in a news release announcing the ruling. “It must in particular implement appropriate technical and organizational measures to identify, before publication, advertisements that contain sensitive data and to verify that the advertiser is actually the person whose data appear in such an advertisement.”

If not, the court added, “the operator must refuse to publish the advertisement, unless the advertiser can demonstrate that that person has given his or her explicit consent to publication or that publication is covered by one of the other exemptions provided for by the GDPR.”

The case originated in 2018 in Romania, when an unidentified individual placed an ad in an online marketplace operated by Russmedia Digital featuring a woman purportedly offering sexual services. The ad included her photograph and phone number.

The woman claimed the ad was false and defamatory and asked the site to remove. Russmedia removed the ad within an hour of being notified, but by then it had already appeared on other websites where it remained available. The woman sued, and after a series of lower court rulings the case landed with the high court in Luxembourg.

Related: Gatekeeper Professions Struggle to Reconcile Data-Protection Obligations With Expanding AML Demands

In a twist that goes to the heart of internet conventions, the court ruled that the operator “must take measures to prevent such advertisements, when they are published on its platform, from being copied and unlawfully published on other websites. To that end, it must implement appropriate technical and organizational security measures.”

Aside from the technical challenges involved in preventing information from going viral, the ruling places significant new operational burdens on website operators.

“This judgment makes clear that online marketplaces cannot avoid their obligations under the GDPR by relying on the liability exemptions for hosting providers in the e-Commerce Directive,” Thijs Kelder, an EU technology law attorney with Pinsent Masons wrote in a blog post.  “This ruling fundamentally changes the compliance landscape by placing the most explicit limits on the e-Commerce Directive’s liability exemptions to date. It also increases the operational risks on these platforms, meaning more robust risk management procedures will need to be implemented by the operators.”

In addition to the compliance challenges for operators, Daphne Keller, the director of platform regulation at the Stanford Law School program in law, science and technology, said in a LinkedIn post that the ruling “created half a dozen extremely serious fundamental rights problems,” for internet users.

“This has major implications for free expression and access to information, age verification and privacy, anonymous speech, and possibly private communications,” she wrote, adding, “I truly can’t imagine how hosting sites can comply.”